That Anthropic is making auto mode the default in Claude Code, I’ve already covered here. What interests me more are the numbers behind it – and they don’t come from Anthropic, but from an independent lab.
The setup
Trajectory Labs, commissioned by Anthropic, designed 72 fresh attack scenarios. All indirect prompt injection – the attempt to steer Claude into malicious actions through manipulated content in files or web pages. Each scenario was run ten times, for 720 attacks total.
Here’s the catch: the attacks were optimized against Claude Opus 4.7, a model that wasn’t even in the test. For the models under review – Opus 5, Sonnet 5, and Fable 5 – they were unseen attacks. And the scenarios had been held out from Anthropic’s own training and testing. No home-field advantage.
The result
Zero. Out of 720 attacks, not a single one got through against Claude in auto mode. For comparison, Trajectory Labs ran the same battery against OpenAI’s GPT-5.6 Sol: a 5.83% success rate in Codex’s auto-review mode, and 19.03% when Codex ran with full access.
Behind this sit three layers of defense: the model’s own alignment, checks on the input side, and a classifier that vets every planned action on the output side. Only when all three are clean does the agent act.
Why it matters
Auto mode exists because the old model didn’t work. Anthropic measured that humans were waving through 97% of all permission requests in Claude Code – reflexively, not through real scrutiny. If you hit “allow” on every other click, you’re not checking anything. A classifier that stops only for genuinely risky actions may well be safer than a numbed-out human.
I stay cautious anyway. Zero hits in 720 attempts is strong, but it’s a test setup, not proof in the field. Attackers don’t sleep, and the next trick is always the one nobody saw coming. Still: if you’re going to let agents take actions, you need exactly these kinds of numbers just to make a decision. That they were gathered independently and don’t shy away from a head-to-head with the competition is worth more than any marketing slide.
Sources: